76295a621b8c9c408aa4434fba3207a9a29a0787ab527bff0ab7bfc89698a307

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Detroit Become Human ultrawide 0.9.9.exe
Size 5.6MB
Sample260814-phcspssgja
SHA256 76295a621b8c9c408aa4434fba3207a9a29a0787ab527bff0ab7bfc89698a307
MD5 a1f4d2b914bf3fb3e701b75d7e160044
SHA1 110c92aade991accaa5f4ea32de056cfe903d013
SHA512 85e2a5c8b22ebb135a3501ecb280e53c8a8d1503024970bb20615c43a60b70aedd1afb8d285f8b2e9f071904d8059812ecda872896910f71e2e5d78e4bb4becd
SSDEEP 98304:Ap8RqCDzHXqkfIBtzEAETgBkeTpPHsH/CN2mpjMzLHjyVLwRG7mc79vl0MEa38N:ACRqIbIecyoa/5HjyVwEmchC7av
TLSH
T15D563315B641D173C81239F54BA8877609A2D7112E72869F77CE0B8ECBF3EE0DE99052
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3344	Detroit Become Human ultrawide 0.9.9.exe
4836	Detroit Become Human ultrawide 0.9.9.exe

Loads dropped DLL 1 IoCs

pid	Process
4836	Detroit Become Human ultrawide 0.9.9.exe

Drops file in System32 directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\user32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\sechost.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\advapi32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\apphelp.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\psapi.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\ole32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\imm32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\imagehlp.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\dxcore.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\win32u.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\shell32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\shlwapi.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\system32\shfolder.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\profapi.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\KERNELBASE.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\shcore.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\system32\uxtheme.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\SYSTEM32\CFGMGR32.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\combase.dll	Detroit Become Human ultrawide 0.9.9.exe
File opened for modification	C:\Windows\System32\GDI32.dll	Detroit Become Human ultrawide 0.9.9.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\comctl32.dll	Detroit Become Human ultrawide 0.9.9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Detroit Become Human ultrawide 0.9.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Detroit Become Human ultrawide 0.9.9.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Detroit Become Human ultrawide 0.9.9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4836	Detroit Become Human ultrawide 0.9.9.exe
4836	Detroit Become Human ultrawide 0.9.9.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeTcbPrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeTcbPrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeLoadDriverPrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeCreateGlobalPrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeLockMemoryPrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: 33	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeSecurityPrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeTakeOwnershipPrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeManageVolumePrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeBackupPrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeCreatePagefilePrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeShutdownPrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeRestorePrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: 33	4836	Detroit Become Human ultrawide 0.9.9.exe
Token: SeIncBasePriorityPrivilege	4836	Detroit Become Human ultrawide 0.9.9.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4836	Detroit Become Human ultrawide 0.9.9.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 3344	3552	Detroit Become Human ultrawide 0.9.9.exe	89
PID 3344 wrote to memory of 4836	3344	Detroit Become Human ultrawide 0.9.9.exe	90

C:\Users\Admin\AppData\Local\Temp\Detroit Become Human ultrawide 0.9.9.exe
"C:\Users\Admin\AppData\Local\Temp\Detroit Become Human ultrawide 0.9.9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC128.tmp\Detroit Become Human ultrawide 0.9.9.exe
  "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC128.tmp\Detroit Become Human ultrawide 0.9.9.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC128.tmp\extracted\Detroit Become Human ultrawide 0.9.9.exe
    "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC128.tmp\extracted\Detroit Become Human ultrawide 0.9.9.exe" "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC128.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CET_Archive.dat

Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC128.tmp\CET_Archive.dat
Size 5.3MB
SHA256 091e46620288f820a4584e46e5bfcf9f9edb31f07cb361475f997599ffa5f885
MD5 64d43cd3f87908ba8d51379026e9980c
SHA1 808035c71fa2f8441922009f42535c8912074b2b
SHA512 10ecec93b115d0a576bf605b28d66b0aea1d8bb0b766292e44c1294edd49213c4f08224740248be0f88bb836ac9021fe30b267007bda80b0ccdfc8110b97b32e
SSDEEP 98304:G8RqCDzHXqkfIBtzEAETgBkeTpPHsH/CN2mpjMzLHjyVLwRG7mc79vl0MEa38NA:fRqIbIecyoa/5HjyVwEmchC7ab
TLSH
T1A846331955A8B9E3DC36305AA9B94F1E4CDB438367E31F1EBB4F05C944C3AA9D1CB092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Detroit Become Human ultrawide 0.9.9.exe

Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC128.tmp\Detroit Become Human ultrawide 0.9.9.exe
Size 189KB
SHA256 dab3003436b6861ae220cc5fdcb97970fc05afdf114c2f91e46eed627ce3d6af
MD5 a65c29111a4cf5a7fdd5a9d79f77bcab
SHA1 c0c59b1f792c975558c33a3b7cf0d94adc636660
SHA512 b37ef3351e8f46f7183550254acce99b54e0199fc37a02cca78b471dc2d8b697769afdaf7e6cfe89422cfed65a8dcc6d158ef52aba5b0ac9350ea05607fefd7f
SSDEEP 3072:/bpNXPzitxNyVg64pEIP9lz3mjoOejfyyswe710LJNEXvXO29s6l8Bji1u78xb/1:/1NXPQNyVg64p5P9lz33OezRswe710Ll
TLSH
T1C4144C95E742833BC4437EF54B8985F65A70EB242D31C0EB32D90B0EDBB5EA06E35256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CET_TRAINER.CETRAINER

Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC128.tmp\extracted\CET_TRAINER.CETRAINER
Size 46KB
SHA256 4373c58068be016027bf45f34fa0909a612d790a7e1ea400f9a917b2c3ca3342
MD5 a57838a0cfac8ec4f4386c2e37420e92
SHA1 9b33c8106be8c6a300297d777f0ddf69ff9e8c93
SHA512 d3dc398335d5fb58f78d33ee6992d56af678c21cd319033c722d22534cf9cdefb1d9610f8b03ee81ec2f4e9de93a63b228dcee72e3ef551f9b4e2b3eee9cfc45
SSDEEP 768:tb6B63O6aQQa7ikiENupEdwxEc9avy7TzZW9rOTm8ZVUUlYK1NRIDhO:Ma9Ypkrwp1Ec9HZW9cfLUQYeID8
TLSH
T1FA2301075C3E70B544A1E1451BFC4E8B837B6503B2AD2E8EBB46D891146F68F3A12E6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Detroit Become Human ultrawide 0.9.9.exe

Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC128.tmp\extracted\Detroit Become Human ultrawide 0.9.9.exe
Size 13.7MB
SHA256 98734a612b20b2354cbcddd6aa8863c7b01eb0f7df45f96751283c348461bba5
MD5 1dfe3c2bcf1a02bbbb4f046e4546e98b
SHA1 5d120d72eef98000602330cd48f0b3e2560fba7d
SHA512 14756d89dfe49781091cb9bd8ca4aa5bd32ea2c3ccc6d4a790aa533e519070a3778f077f10649d4d615854306604d8004daeb3e7802a5a3ebe8b978fd935c9e3
SSDEEP 196608:kE2koBTbNF0+SyrsbqR5XJvAisxae5+EPmz/yhs/nwZ:kaoBTbNF0+SyIbqRVJvAhxB8TgZ
TLSH
T188E65BBBB661CAD9C0CAC17195C38BF15E31BD2448B5124772C5370FAFB68806E99D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defines.lua

Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC128.tmp\extracted\defines.lua
Size 6KB
SHA256 879555f1afe27b22da98bf4129b886b4eec6b76e89c471bb1cca792e74726344
MD5 7916bcb95693345d58f7f60e663cbf75
SHA1 a5c6df5528dcb4c816a8f8da9d9e639bdabb9081
SHA512 38fc73775e846e578c5c9c8cc8cfc1cab9319827a0b8b248d6e8b3230183350e85ad20d82b7464d6b50825c7aac64a143ce7bf8af44c8063f862dfed2598e1a7
SSDEEP 192:0egHuderGTd4G9mSZk/8fdtINfbLmJFcSC5xm+9ch07Q:AHuderlSZk/8FtIF4umMcd
TLSH
T154E1F95A1907521F023617AF6EDD51414AC4AE3CC0E4AA72B35E0C7D7E46828DFE23BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua53-64.dll

Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CETC128.tmp\extracted\lua53-64.dll
Size 522KB
SHA256 522fd7cac73f55f249b82fbaee587db6e527c76eac9837cf54622ee476be8fab
MD5 b19ca65cd5c6f20c77dbc60bce20e826
SHA1 06ef80fc54bc5098b2c8d7c7530f2dd63bd4917d
SHA512 4f0c9573e433efdcd7cc8b82286a2c5eb9ecc1666d535f4f4e4525fc0e58656b41a14f0c1cf3fa6958917632e69b9317a2553ec90a05e1ca3209b0b78dd69c33
SSDEEP 6144:o/OUTZ6gzPjY08B6rrjHP5dqIgvgD3ux+e5nu2pKxcTuMX/mDKF52YyZnoKagQuz:GH6m808BqrjHPY4+H5u2VvmDquoo3wSf
TLSH
T153B47C2D6A6406BAD973D03ACA635647E2F1785903B09BEF82E417B61F377E02577320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download